ML20247R226

Final Safety Evaluation Re LER 87-20 Concerning Interactions Between Steamline Rupture Detection/Isolation Sys,Plant Protective Sys & Control Sys at Facility

ML20247R226
Person / Time
Site:	Fort Saint Vrain
Issue date:	05/26/1989
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20247R222	List: ML20247R217 ML20247R226
References
NUDOCS 8906070177
Download: ML20247R226 (4)

Text

_ _ . _ _ _ _ _- . - _ _ _ _ _ _ . _ _ _ - _ - -

a{

UNITED STATES g [ W g NUCLEAR REGULATORY COMMISSION . 1 r,. ' wAssincrow. o. c. mosss

'f

,o?

.[ .....

' FINAL = SAFETY EVALUATION BY :THE OFFICE OF: NUCLEAR REACTOR REGULATION RELATED TC LER 87-20

' INTERACTIONS OF FORT ST. VRAIN PFS/SLRDIS WITH CONTROL SYSTEMS FORT ST. VRAIN NUCLEAR GENERATING STATION PUBLIC SERVICE COMPANY OF COLORADO U " DGCKET N0; 50-267 1.0; INTPODUCTI0f? Afl0 BACKGROUND The Fcrt St. Vrain (FSV) Plant has originally designed with a Plant.Protec- >

tive System (PPS) providing various levels of. protection to the . reactor and specific equipment iters against abnornial crerating ccrditions. One featurc of

.the plant prctective system was the 1 cop shutdewn, which automatically isolated one of the two secondary coolant loops under certain conditions. The PPS automat-ically closed a number of valves in. e loop as part'of the loop shutdown.

'In 1986, the licensee added a second autcratic prctection syster, the . . .

Steam.Line Rupture Petection/ Isolation System (SLECIS). The SLRDIS is designed to'pretect qualified equipment in the plant from the. harsh environment that-could be created by an urritigated high energy lire break. SLRDIS senses am- .

bient temperatures in the Reactor and Turbine Building and then icclates high energy-lines in both loops' by closing a number of valves. SLRDIS utilizes '

certain tristing PPS circuitry'for this purpose, as well as new circuitry added as part of the SLRDIS redifications. The staff had previously reviewed and .

-approved the'SLRDIS in a safety evaluation (SE) dated February 26,19E7. >

Approval of SLRDIS was also discussed in a SE dated April 3,1987 on the -

licensee's equipment qualification program.

4

~

However, in a licensee event report (LER) dated October 1,1987 (LER 87-020) '

the licensee stated:

"First-in-with-lockout logic is provided into the PPS to prevent autcratic shutdown of both-loops. This lockout feature is overridden in the event of a high energy line break by SLRDIS, which automatically closes the feedwater block and control valves of both loops simultaneously. There are also interlocks provided in the control circuits of the feedwater .

. block valves and feedwater ficw control valves which prevent closing both loop feedwater control valves at the sare time."

l f .In the requests for additional information dated September 20, 1988 and January 12, 1989, the staff indicated their corcern about the potential interacticrs cf the PPS and control system, both of which provide outputs to the feedwater b1cck and flow control valves.

y ,

'&}$ Db $

c = -_ _ _- __--

j

)

In particular, the staff was concerned that the control circuits could override FPS or SLRDIS acticos aric prevent accomplishment of the required

- protective functions, ar.d requested a review of these potential interactier,s against Criterion 19, 20, 21, and 22 of the FSV Final Safety Analysis Report (FSAR).

By letters dated November 22, 1988 ano April 7, 1989, the licensee responded to these concerns.' The following evaluation covers this response.

2.0 EVALUATION The licensee was requested to review the interaction between the SLRDIS and PPS systems and the control system, that could prevent the accomplishment'of the required protective functions. The licensee's evaluation and this evaluation are done against criterion 19, 20, 21 and 22 of the FSV FSAR.

2.1 Criterion 19 The licensee has stated that the SLRDIS system is built to be highly reliable and testable.

The staff is in general acreement with these conclusicos. However, the staff hadnotedinSectionV.2.Ic)ofthelicensee'sreportofNovember 22, 1988, that the SLRDIS relay contacts provide a zero input to the velve position card to close the control valve. However, the provisions to assure that other inputs to the control card er failure of the control-card power supplies, or the centrol card itself were not addressed. This problem could potentially exist for the following groups of valves:

Circulator speed controls, Feedwater flow controls, and Reheat steam bypass pressure ratio control.

The most significant concern was the possibility of multiple failures resulting from failures of a commen power supply. By letter dated April 7,1989, the licensee submitted a more detailed arialysis of the failure modes for these valves. Operation of these valves is based on a combination of electrical, hydraulic and instrument (compressed) air power sources. Both the hydraulic and instrument air systems are designed (and operated) to be single failure proof. Therefore, failures of these power sources did not pose a problem for the SLRDIS system. Power sources for the valves control cards and the electrical control solencids are diverse, with supplies from both instrument bases.

Failure of an individual power supply component (i.e., fuse), or an essential bus can prevent an individual SLRDIS valves from closing. However, by the analysis presented in the licensee's April 7,1989 submittal, the licensee had demonstrated that another valve (s) in the system will close and provide the j needed isolation function.

l In view of the above, the staff concludes that the desired SLRDIS function I

will be performed with reasonable assurance. Thus, the staff concludes the SLRDIS system meets criterion 19 of the FSV FSAR.

w__ _ _ --.

a l

l 2.2 Criterion 20 i

The licensee has stated that the SLRDIS system is sufficiently redundant and independent such that no single failure will prevent an overall system failure or lead to multiple SLRDIS valves failing to close. As noted in the discussion for Criterion 19, the SLRDIS input to the valve positicn cards for certain valves have been analyzed fer common failure modes. Consideration has also  ;

been given to failure rrodes of the various power supplies. Based on the licensee's analysis, the staff concludes the SLRDIS systeni n'eets Criterion 20.

2.3 Criterion 21 The licensee has stated that the objective of the SLRDIS system is met for the case of a single valve or corpenent failure since the valves actuated by SLRDIS are actuated by both SLRDIS loops and are in series with another valve actuated by the other SLRDIS loop. The staff agrees in general that the 4 SLRDIS design is redundant in that multiple valves are closed in each loop, and that this limits the total volume (mass) of high energy fluid that ten escape thrcugh any single line break.

Where valves fail to close due to failure of a power supply, redundant adjacent ,

valves has been identified to perforrn the required function. Thus, there is no pctential for multiple valve failures and the design cbjective is met. Therefore, the staff concludes Criterion 21 is satisfied.

2.4 Criterion 22 The licensee has stated that by the use of isolated centacts, no failure cf I the control circuit can propagate back into the PPS or SLRDIS systems. The staff agrees with this conclusion. The staff has also examined the use of the

~

isolated contacts to control the position of the open or shut type control circuits as indicated in the licensee's discussion of HV-2201, the Loop Feedwater Block Valve. In this circuit, the isolated SLRDIS contacts provide an overriding signal for the closure of the subject valve. Therefore, the staff concludes that Criterion 22 is satisfied.

2.5 Other Considerations i The staff notes that System Description-93-2, entitled "Overall Plant Control I and Plant Protective System" states that on the trip of both circulators in a '

loop results in closure of the reheater inlet attemporator line block and flow j control valves. It is the staff's understanding that the attemporator inlet  !

lines are small, and therefore the closure of these valves by SLRDIS is net  !

required to mitigate the effects of a line break. The licensee confirmed the role of these valves in the operation cf the SLRDIS system in the April 7, 1989 submittal. ,

1

3.0 CONCLUSION

The staff concludes that the SLRDIS design provides adequate isolation between l the PPS and control system functions. The staff has reasonable assurance feilures 1 of the control syster will not affect PPS operation. Furtherraore, the SLRDIS l

L _ - _ _ _ - - - - _ - _ _ . - - - - - - _ - - - - -- - - - - -

m"i ); ,,

j .. -

~ a . ;; c

p. + e' *

.% m :.

b .

~

system will properly actuate _ the desired valves. to close and. reduce the effects -

. of a high-energy -line break. In cases where a' power supply failure'does not -

(.

" ~ allcw a SLRDIS valve'to close', a ' redundant valve in.close proximity is closed and the necessary isolation provided.

Dated: May 26, 1.989

' Principal' Contributor: Kenneth L. Heitner, PD-IV-

[.

9

- _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ _ _ . _ _ . _ _ . _ . _ _ _ _ _ _ _ _ _ _._ _ _ - - . . _ _ . _ _